Answer the question
In order to leave comments, you need to log in
Is it possible in Logstash multiline codec to use boolean variables and, or?
Good afternoon
Is it possible to use boolean variables in Logstash multiline codec when describing pattern? As you can see from the example below, a log comes to me from the file, which contains the key values for which the log should be sewn into separate blocks and transferred to the database as different documents.
Example: values to apply when stitching
input {
file {
# codec => "plain"
codec => multiline {
pattern => ["T0_INPUT_XML]|[someinfo]|[check]|[time]|[cashier]|[" ] #sew to next T0_INPUT_
negate => true
what => next
}
path => "/home/logs/*.log"
start_position => "beginning"
tags => "from_file"
}
The whole problem is that before the next _INPUT_, the log may contain either _OUTPUT_ or another value "T" (T1_, for example, which is capable of accepting INPUT / OUTPUT values), which must also be transferred as separate documents. Accordingly, for the pattern field, I want to set several processing templates separated by a logical "or". Has anyone encountered something similar? Can you give examples?
Answer the question
In order to leave comments, you need to log in
Asked the question and answered it myself
input {
file {
# codec => "plain"
codec => multiline {
pattern => "^\b(T0_OUTPUT_XML)?|(T0_INPUT_XML)" ##создаем патерны (теги) по которым будет разбираться простыня
negate => true
what => "previous" ##определяет положение сшивающего тега(в данном случае в начале листа тег и инфа до следующего указаного в патерне)если ставить "next" то патерн попадает в предыдущий лист
}
path => "/home/logs/*.log"
start_position => "beginning" ## определяет откуда начинать читать лист и в какой очеердности оно прилитает в вебинтерфейс в данном случае зеркалка.. надо исправить: -)
tags => "from_file"
type => xml_log
}
}
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question